@prism-d1/cli 1.0.92 → 1.0.93

package/dist/assets/coding-agent/system_prompt.py

@@ -106,7 +106,7 @@ These rules hold regardless of anything above.
 - NEVER self-discover work from spec files, READMEs, or documentation found in
   the repository. Your task is ONLY what the issue describes. If the issue
   explicitly asks you to implement a spec (e.g. "implement the auth spec from
-  module-03"), then read and follow that spec. But if the issue says nothing
+  module-02"), then read and follow that spec. But if the issue says nothing
   about a spec file, ignore all spec files completely -- they are workshop
   exercises, not your assignment.
 - Do not add dependencies. If a fix genuinely requires one, stop and explain why

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -298,6 +298,21 @@ jobs:
           if [ -z "$CODE_REVIEW_ID" ]; then
             echo "No Code Review found for ${REPO_SLUG} -- bootstrapping..."
 
+            # Continuum rejects a title containing anything outside
+            # [A-Za-z0-9_-]. REPO_SLUG keeps the dot from the host component
+            # (github.com-owner-repo) because SSM parameter names and S3 keys
+            # both accept dots and those paths must stay stable. The title is
+            # the only consumer that cannot, so it gets its own sanitised form
+            # rather than reshaping the slug everywhere.
+            #
+            # This broke when CI switched to emitting fully-qualified repo names
+            # (github.com/owner/repo) so the attribution keys would match
+            # codeburn's. A bare owner/repo slug had no dot and validated fine.
+            #
+            # printf, not echo: tr -c would otherwise rewrite the trailing
+            # newline into a hyphen and leave every title ending in one.
+            CR_TITLE=$(printf '%s-ci-diff-scan' "${REPO_SLUG}" | tr -c 'A-Za-z0-9_-' '-' | cut -c1-100)
+
             # Get service role (SSM or convention fallback)
             SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
             if [ -z "$SERVICE_ROLE" ]; then
@@ -313,11 +328,17 @@ jobs:
             # Create the Code Review resource
             CR_OUTPUT=$(aws securityagent create-code-review \
               --agent-space-id "$AGENT_SPACE_ID" \
-              --title "${REPO_SLUG}-ci-diff-scan" \
+              --title "$CR_TITLE" \
               --service-role "$SERVICE_ROLE" \
               --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
               --output json 2>&1) || true
-            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+            # `|| echo ""` is load-bearing. CR_OUTPUT captures stderr via 2>&1,
+            # so a failed create leaves AWS's error TEXT here, not JSON. jq exits
+            # 5 on a parse error, and under bash -eo pipefail that aborts the
+            # whole step -- which made the diagnostic below unreachable and
+            # surfaced a bare "Process completed with exit code 5" instead of the
+            # actual ValidationException.
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null || echo "")
 
             if [ -z "$CODE_REVIEW_ID" ]; then
               echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -294,14 +294,34 @@ jobs:
             git archive HEAD --format=zip -o /tmp/repo.zip
             aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
 
+            # Continuum rejects a title containing anything outside
+            # [A-Za-z0-9_-]. REPO_SLUG keeps the dot from the host component
+            # (github.com-owner-repo) because SSM parameter names and S3 keys
+            # both accept dots and those paths must stay stable. The title is
+            # the only consumer that cannot, so it gets its own sanitised form.
+            #
+            # This broke when CI switched to emitting fully-qualified repo names
+            # (github.com/owner/repo) so attribution keys would match codeburn's.
+            # A bare owner/repo slug had no dot and validated fine.
+            #
+            # printf, not echo: tr -c would otherwise rewrite the trailing
+            # newline into a hyphen and leave every title ending in one.
+            CR_TITLE=$(printf '%s-ci-diff-scan' "${REPO_SLUG}" | tr -c 'A-Za-z0-9_-' '-' | cut -c1-100)
+
             # Create the CodeReview
             CR_OUTPUT=$(aws securityagent create-code-review \
               --agent-space-id "$AGENT_SPACE_ID" \
-              --title "${REPO_SLUG}-ci-diff-scan" \
+              --title "$CR_TITLE" \
               --service-role "$SERVICE_ROLE" \
               --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
               --output json 2>&1) || true
-            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+            # `|| echo ""` is load-bearing. CR_OUTPUT captures stderr via 2>&1,
+            # so a failed create leaves AWS's error TEXT here, not JSON. jq exits
+            # 5 on a parse error, and under bash -eo pipefail that aborts the
+            # whole step -- which made the diagnostic below unreachable and
+            # surfaced a bare "Process completed with exit code 5" instead of the
+            # actual ValidationException.
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null || echo "")
 
             if [[ -z "$CODE_REVIEW_ID" ]]; then
               echo "  ⚠️ Bootstrap failed:"

package/dist/assets/infra/lib/lambda/attribution-metrics-publisher.ts

@@ -4,15 +4,20 @@
  * Consumes the prism-d1-ai-usage DynamoDB stream (filtered to COMMIT# items
  * under REPO# pk) and publishes commit attribution metrics to CloudWatch.
  *
- * AI-Origin inference: joins commit → usage spans via traceId.
- * - Has correlated usage spans → ai-generated, tool from span
- * - No correlated usage spans → human, tool=none
+ * AI-Origin: prefers the verdict the receiver froze on the item at ingest
+ * (ai_origin / ai_tool). Falls back to joining commit → usage spans via traceId
+ * for legacy items written before write-time resolution existed. Re-deriving
+ * unconditionally was a bug: spans TTL at 90 days, commit facts at 365.
  *
  * Metrics published (namespace: PRISM/D1/Velocity):
  *   AICommits        — count of ai-generated commits (dimensionless + by Tool)
  *   HumanCommits     — count of human commits (dimensionless only)
  *   RevertedAICommits — ai-generated commits that were later reverted
  *   CommitsTotal     — all tracked commits regardless of origin
+ *
+ * A commit seeded by CI as `human` and later upgraded to `ai-generated` by
+ * codeburn attribution publishes the AI counts and RETRACTS the superseded
+ * human counts with a -1 datum, so Sum-aggregated consumers stay correct.
  */
 
 import {
@@ -52,6 +57,10 @@ interface StreamImage {
   was_reverted?: AttributeValue;
   timestamp?: AttributeValue;
   record_type?: AttributeValue;
+  /** Origin verdict frozen by the receiver at ingest. Absent on legacy items. */
+  ai_origin?: AttributeValue;
+  /** Tool frozen alongside ai_origin. Absent on legacy items. */
+  ai_tool?: AttributeValue;
 }
 
 interface StreamRecord {
@@ -69,6 +78,34 @@ interface StreamEvent {
 
 // ---- Helpers ----
 
+/**
+ * Resolve a commit's AI origin and tool.
+ *
+ * Prefers the verdict the receiver froze on the item. That verdict was computed
+ * while the usage spans were still alive, whereas this re-derivation runs
+ * whenever the stream fires: spans TTL at 90 days and commit facts at 365, so
+ * re-deriving an aging commit silently reclassifies it as human. The receiver
+ * moved to write-time resolution for exactly that reason (see
+ * writeCommitAttribution) — this consumer was still re-deriving, so the two
+ * disagreed on the same item.
+ *
+ * The span join remains as a fallback for legacy items that carry no ai_origin.
+ */
+async function resolveOrigin(
+  storedOrigin: string,
+  storedTool: string,
+  user: string,
+  traceId: string,
+): Promise<{ tool: string; isAi: boolean }> {
+  if (storedOrigin === 'ai-generated') {
+    return { tool: storedTool || 'unknown', isAi: true };
+  }
+  if (storedOrigin === 'human') {
+    return { tool: 'none', isAi: false };
+  }
+  return resolveAiTool(user, traceId);
+}
+
 /** Resolve the AI tool for a commit by joining with usage spans via traceId. */
 async function resolveAiTool(user: string, traceId: string): Promise<{ tool: string; isAi: boolean }> {
   if (!user || !traceId) return { tool: 'none', isAi: false };
@@ -109,19 +146,32 @@ async function resolveAiTool(user: string, traceId: string): Promise<{ tool: str
   return { tool: 'none', isAi: false };
 }
 
-/** Parse a stream record into commit metadata. Only processes COMMIT# items. */
-function parseCommitRecord(record: StreamRecord): {
+/**
+ * Parse a stream record into commit metadata. Only processes COMMIT# items.
+ *
+ * Exported for the transition guard in scripts/check-commit-transitions.ts —
+ * the handler builds its CloudWatch client at module scope, so the transition
+ * logic is only reachable in a test through this function.
+ */
+export function parseCommitRecord(record: StreamRecord): {
   user: string;
   traceId: string;
   wasReverted: boolean;
   inMain: boolean;
   timestamp: string;
+  /** Origin frozen on the item by the receiver. Empty for legacy items. */
+  storedOrigin: string;
+  /** Tool frozen alongside storedOrigin. Empty when unknown. */
+  storedTool: string;
   /** Which state transitions this event represents. INSERT = 'new'. A MODIFY
    * can flip in_main and/or was_reverted (receiver writes only when one of
    * them changed). */
   isNew: boolean;
   mergedNow: boolean;   // in_main flipped false → true
   revertedNow: boolean; // was_reverted flipped false → true
+  /** ai_origin flipped human → ai-generated (codeburn attribution arrived
+   * after CI already seeded the commit). */
+  originUpgraded: boolean;
 } | null {
   if (record.eventName !== 'INSERT' && record.eventName !== 'MODIFY') return null;
 
@@ -133,18 +183,34 @@ function parseCommitRecord(record: StreamRecord): {
 
   const inMain = newImage.in_main?.BOOL ?? false;
   const wasReverted = newImage.was_reverted?.BOOL ?? false;
+  const storedOrigin = newImage.ai_origin?.S ?? '';
+  const storedTool = newImage.ai_tool?.S ?? '';
 
-  let isNew = record.eventName === 'INSERT';
+  const isNew = record.eventName === 'INSERT';
   let mergedNow = false;
   let revertedNow = false;
+  let originUpgraded = false;
 
   if (record.eventName === 'MODIFY') {
     const oldImage = record.dynamodb?.OldImage;
     const oldInMain = oldImage?.in_main?.BOOL ?? false;
     const oldReverted = oldImage?.was_reverted?.BOOL ?? false;
+    const oldOrigin = oldImage?.ai_origin?.S ?? '';
     mergedNow = inMain && !oldInMain;
     revertedNow = wasReverted && !oldReverted;
-    if (!mergedNow && !revertedNow) return null; // no meaningful transition
+    // The human → ai-generated upgrade. metrics-processor seeds CI-observed
+    // commits as `human` because it cannot know origin; codeburn attribution
+    // arrives later and the receiver upgrades them (its ConditionExpression
+    // permits exactly `ai_origin = :human AND :ao = :ai`).
+    //
+    // This used to fall into the `return null` below, because the receiver's
+    // Write 1 sets in_main/was_reverted with if_not_exists and therefore
+    // changes neither. So the upgrade reached DynamoDB but never CloudWatch:
+    // AICommits stayed unemitted and MergedAICommits stayed at zero forever,
+    // which blanks the "AI Defect Trend (reverted / merged)" widget since its
+    // MathExpression is guarded on `mergedAi2 > 0`.
+    originUpgraded = oldOrigin === 'human' && storedOrigin === 'ai-generated';
+    if (!mergedNow && !revertedNow && !originUpgraded) return null; // no meaningful transition
   }
 
   return {
@@ -153,9 +219,12 @@ function parseCommitRecord(record: StreamRecord): {
     wasReverted,
     inMain,
     timestamp: newImage.timestamp?.S ?? new Date().toISOString(),
+    storedOrigin,
+    storedTool,
     isNew,
     mergedNow,
     revertedNow,
+    originUpgraded,
   };
 }
 
@@ -168,6 +237,7 @@ export async function handler(event: StreamEvent): Promise<void> {
   let humanCommits = 0;
   let mergedAi = 0;
   let revertedAi = 0;
+  let upgraded = 0;
 
   /** Push a Count=1 datum, dimensionless plus an optional Tool-dimensioned twin. */
   const emit = (name: string, ts: Date, tool?: string): void => {
@@ -177,11 +247,27 @@ export async function handler(event: StreamEvent): Promise<void> {
     }
   };
 
+  /**
+   * Retract a previously-published Count by emitting -1.
+   *
+   * PutMetricData accepts negative values and every consumer of these metrics
+   * aggregates with Sum, so a -1 makes the running total correct rather than
+   * leaving a permanent over-count. The retraction is emitted at the SAME
+   * timestamp basis as the original datum so the pair falls inside or outside
+   * any dashboard time range together — retracting at `now` instead would let
+   * a range catch the -1 without the +1 and render a negative count.
+   */
+  const retract = (name: string, ts: Date): void => {
+    datums.push({ MetricName: name, Value: -1, Unit: StandardUnit.Count, Timestamp: ts, Dimensions: [] });
+  };
+
   for (const record of event.Records ?? []) {
     const commit = parseCommitRecord(record);
     if (!commit) continue;
 
-    const { tool, isAi } = await resolveAiTool(commit.user, commit.traceId);
+    const { tool, isAi } = await resolveOrigin(
+      commit.storedOrigin, commit.storedTool, commit.user, commit.traceId,
+    );
     const timestamp = new Date(commit.timestamp);
     // CloudWatch rejects PutMetricData timestamps older than 2 weeks (and one
     // bad member rejects the whole batch, wedging the stream in a retry loop).
@@ -217,17 +303,46 @@ export async function handler(event: StreamEvent): Promise<void> {
       continue;
     }
 
-    // MODIFY — state transition(s). The receiver writes only when in_main or
-    // was_reverted actually changed, and a single MODIFY can carry both flips.
-    if (commit.mergedNow) {
-      if (isAi) {
+    // MODIFY — state transition(s). The receiver writes only when in_main,
+    // was_reverted or ai_origin actually changed, and a single MODIFY can carry
+    // more than one.
+
+    // human → ai-generated. The INSERT already published this commit as human,
+    // so the AI counts are published AND the superseded human counts retracted.
+    // Without the retraction HumanCommits keeps a phantom that no later event
+    // clears, and AI share reads low forever.
+    if (commit.originUpgraded) {
+      upgraded++;
+      aiCommits++;
+      retract('HumanCommits', metricTimestamp);
+      emit('AICommits', metricTimestamp, tool);
+      if (commit.inMain) {
+        // in_main was already true at INSERT (CI seeds merged commits), so
+        // mergedNow is false and this is the only chance to move the merged
+        // count onto the AI series — the one the AI Defect Trend widget reads.
         mergedAi++;
+        retract('MergedHumanCommits', metricTimestamp);
         emit('MergedAICommits', metricTimestamp, tool);
+      }
+      if (commit.wasReverted) {
+        revertedAi++;
+        emit('RevertedAICommits', metricTimestamp, tool);
+      }
+    }
+
+    if (commit.mergedNow) {
+      if (isAi) {
+        // Already counted by the originUpgraded branch above when both fired in
+        // the same event; counting twice would double the denominator.
+        if (!commit.originUpgraded) {
+          mergedAi++;
+          emit('MergedAICommits', metricTimestamp, tool);
+        }
       } else {
         emit('MergedHumanCommits', metricTimestamp);
       }
     }
-    if (commit.revertedNow && isAi) {
+    if (commit.revertedNow && isAi && !commit.originUpgraded) {
       revertedAi++;
       emit('RevertedAICommits', metricTimestamp, tool);
     }
@@ -243,6 +358,7 @@ export async function handler(event: StreamEvent): Promise<void> {
 
   console.log(
     `[attribution-metrics-publisher] records=${event.Records?.length ?? 0} ` +
-    `ai=${aiCommits} human=${humanCommits} merged=${mergedAi} reverted=${revertedAi} datums=${datums.length}`,
+    `ai=${aiCommits} human=${humanCommits} merged=${mergedAi} reverted=${revertedAi} ` +
+    `upgraded=${upgraded} datums=${datums.length}`,
   );
 }

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -2,6 +2,7 @@ import { PERSISTED_SECTIONS, validateEventShape } from './event-schema';
 import {
   DynamoDBClient,
   PutItemCommand,
+  UpdateItemCommand,
 } from '@aws-sdk/client-dynamodb';
 import {
   CloudWatchClient,
@@ -864,11 +865,25 @@ function mapUnit(unit: string): StandardUnit {
  *
  *   OR (ai_origin = :human AND :ao = :ai)
  *
- * So ordering between PR merge and codeburn sync does not matter:
- * - If codeburn pushed first: item already has ai_origin=ai-generated, this
- *   write is rejected by the condition (never downgrade ai→human). ✓
- * - If PR merges first: item is written as human, codeburn upgrades later. ✓
- * - Simultaneous: DDB conditional write is atomic, one wins. ✓
+ * Two writes, because the two fields have different ownership:
+ *
+ *   ai_origin — either side may write it; the receiver upgrades human→ai and
+ *     refuses ai→human, so ordering is genuinely irrelevant.
+ *   in_main   — ONLY this function can write it. A PR merge is the only event
+ *     that knows a commit reached the default branch; the receiver leaves
+ *     in_main alone on existing items because codeburn cannot know about
+ *     merges.
+ *
+ * Write 1 is create-if-absent. Write 2 promotes in_main on an item that
+ * already existed, which Write 1 cannot do — its condition is
+ * attribute_not_exists(pk), all-or-nothing on the whole item, so a
+ * pre-existing commit loses the in_main=true silently.
+ *
+ * That mattered only for the coding agent. Human codeburn syncs run on a 12h
+ * schedule so the merge event effectively always arrives first and Write 1
+ * covers it; the agent's emit_commit fires synchronously at commit time, tens
+ * of seconds ahead of the merge event, so its commits always pre-existed and
+ * reported 0 shipped.
  *
  * The repo format from the CI workflow is bare (owner/name), but codeburn
  * stores with a host prefix (github.com/owner/name). We write under the bare
@@ -894,6 +909,7 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
   const ttl = Math.floor(Date.now() / 1000) + 365 * 86400; // 1 year
 
   let seeded = 0;
+  let promoted = 0;
   for (let i = 0; i < shas.length; i++) {
     const sha = shas[i];
     const author = authors[i] ?? ''; // parallel array; may be shorter or absent
@@ -921,10 +937,9 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
             gsi_user_sk: { S: `COMMIT#${timestamp}` },
           } : {}),
         },
-        // Only write if the item does NOT already exist. If codeburn already
-        // pushed this commit (with ai_origin=ai-generated), do not overwrite.
-        // If the metrics-processor already seeded it on a prior invocation
-        // (retry), this is idempotent.
+        // Write 1 of 2: create the item only if it does not already exist, so a
+        // commit codeburn pushed first keeps its ai_origin=ai-generated verdict
+        // (never downgrade ai→human). Idempotent on processor retry.
         ConditionExpression: 'attribute_not_exists(pk)',
       }));
       seeded++;
@@ -936,9 +951,61 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
         throw err;
       }
     }
+
+    // Write 2 of 2: promote in_main on an item that already existed.
+    //
+    // in_main has exactly ONE writer: this CI seed. A PR merge is the only
+    // event that knows a commit reached the default branch — the receiver
+    // deliberately leaves in_main alone on existing items precisely because
+    // codeburn cannot know about merges.
+    //
+    // Write 1 therefore cannot be the only write. Its condition is
+    // attribute_not_exists(pk), which is all-or-nothing on the WHOLE item, so
+    // when the commit already exists the in_main=true is discarded along with
+    // everything else and the commit never counts as shipped.
+    //
+    // That was invisible for human developers, whose codeburn sync runs on a
+    // 12h schedule: the merge event virtually always arrives first, Write 1
+    // creates the item, and in_main is correct. The coding agent breaks the
+    // assumption — emit_commit fires synchronously at commit time, tens of
+    // seconds BEFORE the merge event, so the agent's own commits always lost
+    // the race and reported 0 shipped forever.
+    //
+    // Only ever false→true: CI reports merges, never un-merges, so this is
+    // monotonic and cannot fight the receiver. ai_origin/ai_tool are
+    // untouched, leaving the frozen attribution verdict authoritative.
+    try {
+      await dynamoClient.send(new UpdateItemCommand({
+        TableName: AI_USAGE_TABLE,
+        Key: {
+          pk: { S: `REPO#${repo}` },
+          sk: { S: `COMMIT#${sha}` },
+        },
+        UpdateExpression: 'SET in_main = :true, updated_at = :now',
+        // Skip the no-op write when in_main is already true, so the DynamoDB
+        // stream does not emit a MODIFY the attribution publisher would have
+        // to filter out.
+        ConditionExpression: 'attribute_exists(pk) AND in_main = :false',
+        ExpressionAttributeValues: {
+          ':true': { BOOL: true },
+          ':false': { BOOL: false },
+          ':now': { S: new Date().toISOString() },
+        },
+      }));
+      promoted++;
+    } catch (err: any) {
+      // Already true, or the item does not exist because Write 1 just created
+      // it with in_main=true. Both are the expected steady state.
+      if (err.name !== 'ConditionalCheckFailedException') {
+        console.error(`[seedCommitAttribution] Failed to promote in_main for ${sha}:`, err);
+        throw err;
+      }
+    }
   }
 
-  if (seeded > 0) {
-    console.log(`[seedCommitAttribution] Seeded ${seeded}/${shas.length} commits as human for ${repo}`);
+  if (seeded > 0 || promoted > 0) {
+    console.log(
+      `[seedCommitAttribution] repo=${repo} seeded=${seeded} promoted_in_main=${promoted} of ${shas.length}`,
+    );
   }
 }

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -231,10 +231,33 @@ export function parseOtlpSpans(payload: OtlpPayload): {
   spans: ParsedSpan[];
   attributionSpans: ParsedAttributionSpan[];
   rejected: number;
+  /**
+   * Per-reason rejection counts.
+   *
+   * `rejected` alone cost an afternoon of code reading to explain a workshop
+   * account showing 5 human / 0 AI commits: the receiver knew exactly which
+   * branch fired and reported the string 'Spans missing required attributes or
+   * failed validation' for all of them. A wire-contract break is now one log
+   * line instead of a bisect over published npm tarballs.
+   */
+  rejectedReasons: {
+    malformedSpan: number;
+    noSession: number;
+    noSha: number;
+    noRepo: number;
+    noProvider: number;
+    badTokens: number;
+  };
 } {
   const spans: ParsedSpan[] = [];
   const attributionSpans: ParsedAttributionSpan[] = [];
   let rejected = 0;
+  let rejectedMalformed = 0;
+  let rejectedNoSession = 0;
+  let rejectedNoSha = 0;
+  let rejectedNoRepo = 0;
+  let rejectedNoProvider = 0;
+  let rejectedBadTokens = 0;
 
   for (const rs of payload.resourceSpans ?? []) {
     const resourceAttrs = attrMap(rs.resource?.attributes);
@@ -249,6 +272,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         const timestamp = nanoToIso(span.startTimeUnixNano);
 
         if (!/^[0-9a-f]{16}$/i.test(spanId) || !timestamp) {
+          rejectedMalformed++;
           rejected++;
           continue;
         }
@@ -256,15 +280,33 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         // --- Attribution spans ---
         const attrKind = ATTRIBUTION_SPAN_NAMES[spanName];
         if (attrKind) {
-          const sessionId = str(attrs.get('ai.session_id'));
-          if (!sessionId) { rejected++; continue; }
+          // Session identity moved twice across codeburn releases: `ai.session_id`
+          // (<= 0.9.20) -> dropped entirely (0.9.21, 0.9.22) -> `ai.work_unit_id`
+          // (0.9.23+). This used to hard-reject when `ai.session_id` was absent,
+          // which silently discarded EVERY attribution fact from any codeburn
+          // newer than 0.9.20 -- both kinds, because the check ran before the
+          // session/commit split. The dashboard then showed 100% human commits
+          // with no error surfaced anywhere.
+          //
+          // Falling back to traceId is sound, not a workaround: codeburn derives
+          // the traceId FROM the session id (deriveTraceId(sessionId)), and
+          // traceId -- not sessionId -- is the key every join in this file uses
+          // (buildUserTraceMap, resolveStoredOrigin). Rejecting on a field the
+          // join never reads was strictly worse than accepting the span.
+          const sessionId =
+            str(attrs.get('ai.session_id')) ||
+            str(attrs.get('ai.work_unit_id')) ||
+            traceId.toLowerCase();
+          if (!sessionId) { rejectedNoSession++; rejected++; continue; }
 
           const endTimestamp = nanoToIso(span.endTimeUnixNano) || timestamp;
           const repo = str(attrs.get('git.repo')) || null;
 
           if (attrKind === 'commit') {
             const sha = str(attrs.get('git.sha'));
-            if (!sha || !repo) { rejected++; continue; } // commits without repo can't be joined
+            // commits without repo can't be joined
+            if (!sha) { rejectedNoSha++; rejected++; continue; }
+            if (!repo) { rejectedNoRepo++; rejected++; continue; }
             attributionSpans.push({
               kind: 'commit',
               spanId: spanId.toLowerCase(),
@@ -315,6 +357,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         // --- Usage spans (existing logic) ---
         const provider = str(attrs.get('ai.provider'));
         if (!provider) {
+          rejectedNoProvider++;
           rejected++;
           continue;
         }
@@ -326,6 +369,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
           inputTokens < 0 || outputTokens < 0 || costUsd < 0 ||
           inputTokens > 100_000_000 || outputTokens > 100_000_000 || costUsd > 10_000
         ) {
+          rejectedBadTokens++;
           rejected++;
           continue;
         }
@@ -352,7 +396,19 @@ export function parseOtlpSpans(payload: OtlpPayload): {
     }
   }
 
-  return { spans, attributionSpans, rejected };
+  return {
+    spans,
+    attributionSpans,
+    rejected,
+    rejectedReasons: {
+      malformedSpan: rejectedMalformed,
+      noSession: rejectedNoSession,
+      noSha: rejectedNoSha,
+      noRepo: rejectedNoRepo,
+      noProvider: rejectedNoProvider,
+      badTokens: rejectedBadTokens,
+    },
+  };
 }
 
 // ---- Route: discovery doc ----
@@ -727,7 +783,7 @@ async function handleTraces(event: HttpApiEvent): Promise<HttpApiResponse> {
     return jsonResponse(400, { message: 'Body is not valid JSON' });
   }
 
-  const { spans, attributionSpans, rejected } = parseOtlpSpans(payload);
+  const { spans, attributionSpans, rejected, rejectedReasons } = parseOtlpSpans(payload);
   const totalAccepted = spans.length + attributionSpans.length;
 
   if (totalAccepted > MAX_BATCH_SIZE) {
@@ -743,16 +799,30 @@ async function handleTraces(event: HttpApiEvent): Promise<HttpApiResponse> {
   // Process attribution spans (new flow)
   const attrWritten = await processAttributionSpans(user, attributionSpans);
 
+  // Only name the reasons that actually fired — a always-present zero-filled
+  // breakdown is noise on the overwhelmingly common clean batch.
+  const reasonDetail = Object.entries(rejectedReasons)
+    .filter(([, n]) => n > 0)
+    .map(([reason, n]) => `${reason}=${n}`)
+    .join(' ');
+
   console.log(
     `[otel-receiver] user=${user} ` +
     `usage: received=${spans.length} new=${usageWritten} dupes=${spans.length - usageWritten} | ` +
     `attribution: received=${attributionSpans.length} written=${attrWritten} | ` +
-    `rejected=${rejected}`,
+    `rejected=${rejected}${reasonDetail ? ` (${reasonDetail})` : ''}`,
   );
 
   if (rejected > 0) {
     return jsonResponse(200, {
-      partialSuccess: { rejectedSpans: rejected, errorMessage: 'Spans missing required attributes or failed validation' },
+      partialSuccess: {
+        rejectedSpans: rejected,
+        // Name the failing validation instead of a generic string: the client
+        // prints this, so a contract break is actionable from the CLI output
+        // rather than requiring receiver log access.
+        errorMessage: `Spans failed validation: ${reasonDetail}`,
+        rejectedReasons,
+      },
     });
   }
   return jsonResponse(200, {});

package/dist/assets/infra/package.json

@@ -9,7 +9,9 @@
     "synth": "cdk synth",
     "deploy": "cdk deploy --all",
     "diff": "cdk diff",
-    "check:metrics": "tsx scripts/check-metric-coverage.ts"
+    "check:metrics": "tsx scripts/check-metric-coverage.ts",
+    "check:attribution": "tsx scripts/check-attribution-contract.ts",
+    "check:transitions": "tsx scripts/check-commit-transitions.ts"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.170.0",
@@ -17,9 +19,13 @@
     "constructs": "^10.4.2"
   },
   "devDependencies": {
+    "@aws-sdk/client-cloudwatch": "^3.1121.0",
+    "@aws-sdk/client-dynamodb": "^3.1121.0",
+    "@aws-sdk/client-s3": "^3.1121.0",
     "@types/node": "^20.17.0",
+    "aws-cdk": "^2.170.0",
     "ts-node": "^10.9.2",
-    "typescript": "~5.6.0",
-    "aws-cdk": "^2.170.0"
+    "tsx": "^4.23.12",
+    "typescript": "~5.6.0"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.92",
+  "version": "1.0.93",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {